I have a sourcetype the provides results for dst if it has one result or dst{} with multiple results.
I am attempting to get this into a data model to be used; however I can't get dst{} to work.
dst=dest works just fine, but dst{}=dest does not work.
When doing dst{}= (IP address), the search works just fine. So I know it doesn't have an issue finding the information. I am missing something for what is needed to make it work within a data model. After researching for a couple days and failing, I thought I'd ask the community for their knowledge.
